Name :	Lasco.A
Category:	Malware
Type:	Virus
Platform:	SymbOS

Lasco.A is a bluetooth using worm and SIS file infecting virus that runs in Symbian mobile phones that support Series 60 platform. Lasco.A replicates over bluetooth connections and arrives to phone messaging inbox as velasco.sis file that contains the worm.
When user clicks the velasco.sis and chooses to install the velasco.sis
file the worm activates and starts looking for new devices to infect
over bluetooth.



When Lasco worm finds another bluetooth device it will start sending
copies of velasco.sis file to it, as long as the target phone is in range.
Like Cabir.H,Lasco.A is capable of finding a new target, after
the first one has gone out of range.

In addition of sending itself over bluetooth the Lasco.A is also capable
of replicating by inserting itself into other SIS files found in the device.
Then if such Lasco.A infected SIS files are copied into another device,
Lasco.A install will start inside the first installation task, asking
user whether to install Velasco.



Please note that SIS files infected by Lasco.A will not be automatically
sent to other devices. The only way to get infected by Lasco.A infected
file other than the original Velasco.SIS is to manually copy and install
it to another device.

The Lasco.A is based on the same source as Cabir.H and is very
similar to it. The main difference between Cabir.H and Lasco.A
is the SIS file infection routine.

Please note that Lasco worm can reach only mobile phones that support
bluetooth, and are in discoverable mode.



Setting you phone into non-discoverable (hidden) Bluetooth mode
will protect your phone from Cabir worm.

But once the phone is infected it will try to infect other systems
even as user tries to disable bluetooth from system settings.

Disinfection


F-Secure Mobile Anti-Virus will detect the Lasco.A
and delete the worm components. After deleting worm files you
can delete this directory:
c:\system\symbiansecuredata\velasco\



If your phone is infected with Lasco.A and you cannot install files
over bluetooth, you can download F-Secure Mobile Anti-Virus directly
to your phone

1. Open web browser on the phone

2. Go to http://mobile.f-secure.com

3. Select link "Download F-Secure Mobile Anti-Virus" and then select phone model

4. Download the file and select open after download

5. Install F-Secure Mobile Anti-Virus

6. Go to applications menu and start Anti-Virus

7. Activate Anti-Virus and scan all files

Replication over bluetooth

Lasco.A replicates over bluetooth in velasco.sis file that contains the worm main executable velasco.app, system recognizer marcos.mdl
and resource file velasco.rsc. The SIS file contains autostart settings that will automatically execute velasco.app after the SIS file is being installed.

The velasco.sis file will not arrive automatically to the target device, so user needs to answer yes to the transfer question while the infected
device is still in range.

When the Lasco.A worm is activated it will start looking for other bluetooth devices, and starts sending infected velasco.sis files to the first device it finds. After the first target phone is out of range the Lasco.A will continue searching and infecting other phones.

This modification in the replication mechanism, will make it more likely that Lasco.A will spread quickly once in the wild.

Replication by infecting SIS files

Lasco.A replicates also by searching the infected device for all SIS installation files. And infecting them by adding the velasco.sis installation file as last file in the SIS archive.

The Lasco.A will also modify the infected SIS file header so that the embedded velasco SIS installation will start automatically after the host SIS file is installed. But while the Lasco.A is installation is started automatically, the installation sequence will still be normal and use will be asked whether he wants to install Velasco, and user will get warning about missing signature in the SIS file.

Infection

When the velasco.sis file is installed the installer will copy the worm executables into following locations:


When the velasco.app is executed it copies the following files:




This is most likely done in case user installs the application to memory card, or to avoid user trying to disinfect the worm by uninstalling the original SIS file.

Then the worm will recreate the velasco.sis file from worm component files and data blocks that are in velasco.app.

After recreating the SIS file the Lasco.A will search for all SIS files in the device, add itself into those files and modify the SIS file header so that the Lasco.A embedded into target SIS files will activate automatically upon install of that SIS file into the device.